Threat Intelligence Bulletin: 11/06/2020 - 11/12/2020

Breach Disclosure: Lazada RedMart

Singapore's largest online grocery store Lazada RedMart has suffered a data breach, impacting over a million customers. This data breach was put up for sale on a popular hacker forum. The leaked data contains approximately 1.1 million unique customer email addresses, SHA-1 hashed passwords, first and last name, phone numbers, mailing addresses, billing addresses, partial credit card numbers, and expiration dates.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have obtained customer data belonging to Lazada RedMart and posted it for sale on a popular hacker forum via a data broker under the alias of ExpertData. The price is undisclosed within the post however it has been reported the brokers are asking for $1500 for the full database. The data appears to originate from a Mongo DB which was accessible to the internet. Lazada are aware of the breach and notified their customers via email.

Figure 1: RedMart database advertised for sale on a popular hacker forum

The leaked data includes:

• Email addresses
• SHA-1 hashed passwords
• First and last name
• Phone numbers
• Address
• Partial credit card numbers, and expiration dates

Lazada have also reported the data is 18 months old and have reset all customer passwords as a precaution, however, some data within the breached database is timestamped from May and July 2020.

Figure 2: Excerpt from the sample data posted by ExpertData

Breach Disclosure: Mashable

The technolody and culture news website, Mashable, has suffered a data breach, impacting over 500,000 users. This data breach was put up for sale on a popular hacker forum. The leaked data contains full names, locations, email addresses, genders, IP addresses, and links to social media profiles of users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The hacker under the alias of ShinyHunters has stolen the customer data belonging to Mashable and posted it for sale on a popular hacker forum. According to the ad placed on the hacker forum, there is data on over 500,000 users which includes:

• Email Addresses
• User Agents
• IP Addresses
• Oauth Tokens
• First Names
• Last Names
• Geographical Locations
• Social Links
• Interests
• Dates of birth

Mashable have issued a statement on the incident ensuring users that no password or financial data has been compromised. The amount of information contained on each individual however could lead to spear-phishing attacks targeting an individuals interests, or using their personal details in order to gain trust in the sender.

Figure 1: Mashable database ad on a popular hacker forum.

Figure 2: Excerpt of the breached data.

The threat actor which authored the thread known as "ShinyHunters" has recently been involved in multiple other data breaches and subsequent selling of customer data and has gathered a reputable status within the marketplace.

Breach Disclosure: Animal Jam

Animal Jam, a popular online game and app aimed at children, has suffered a data breach impacting almost 40 million users. This data breach was put up for sale on a popular hacker forum. The leaked data contains usernames, IP addresses, dates of birth, physical addresses, parent names and passwords stored as PBKDF2 hashes of users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Between approximately the 10th-12th October 2020, hackers managed to penetrate a server operated by WildWorks, a third-party vendor used by Animal Jam for intra-company communication. WildWorks were notified by researchers when they discovered the database for sale on a popular hacker forum on November 11th 2020. Animal Jam have released a statement notifying users of the breach and outlining the data which was obtained by the hackers. As a precaution all user passwords have been reset.

This data consists of:

• Email addresses used to create approximately 7 million Animal Jam and Animal Jam Classic parent accounts
• Approximately 32 million player usernames associated with these parent accounts
• Passwords associated with those user accounts, but in encrypted form
• 14.8M records include the birth year the player entered at account creation
• 23.9M records include the gender the player entered at account creation
• 5.7M accounts include the full birthday the player entered at account registration
• 12,653 of the parent accounts include a parent’s full name and billing address (but no other billing info)
• 16,131 of the parent accounts include a parent’s first and last name, without a billing address

The database being sold appears to have originated from the hacker under the alias of ShinyHunters, which has recently been selling and distributing breached data from multiple companies via popular hacker forums.

Figure 1: Animal Jam database ad on a popular hacker forum.

Figure 2: Schema from the SQL dump of the breached data.

Since the data has been available, other users of the hacker forum are beginning to use their resources to crack the hashes from the breached data and sell clear text credentials.

Figure 3: Ad offering to sell 500,000 cracked sets of credentials

Patch Tuesday Notes 11/11/2020

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities

Details

Highlights:

Microsoft's Patch Tuesday update for November 2020 contained 112 vulnerabilities in total, with:

• 1 vulnerability rated as Critical
• 67 vulnerabilities rated as High
• 43 vulnerabilities rated as Medium
• 1 vulnerability rated as Low

Critical vulnerabilities

The most notable critical-rated vulnerability is tracked as CVE-2020-17051.

CVE-2020-17051

CVE-2020-17051 is a remote code execution vulnerability in Windows Network File System. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Network File System component. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The November Microsoft Patch Tuesday Update contains a zero-day tracked as CVE-2020-17087. CVE-2020-17087 was publicly disclosed by the Google Project Zero and TAG security teams on October 30, 2020. According to Google, the vulnerability is already seeing active exploitation. As of 12 November 2020, a PoC to for the vulnerability is located on Github at https://github.com/TinToSer/CVE2020-17087.

The following products are affected by CVE-2020-17051:

• Windows 10 Version 1903 for ARM64-based Systems
• Windows Server 2016
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 2004 for x64-based Systems
• Windows Server version 1909 (Server Core installation)
• Windows Server version 2004 (Server Core installation)
• Windows 8.1 for 32-bit systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 10 Version 1903 for 32-bit Systems
• Windows 8.1 for x64-based systems
• Windows Server 2012
• Windows Server 2016 (Server Core installation)
• Windows 10 Version 20H2 for x64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows Server version 1903 (Server Core installation)
• Windows Server version 20H2 (Server Core Installation)
• Windows 10 Version 2004 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2019
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows RT 8.1
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

High-severity vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2020-17087, CVE-2020-16970, CVE-2020-17084, CVE-2020-17016, CVE-2020-17061, and CVE-2020-17042.

CVE-2020-17087

CVE-2020-17087 is a privilege escalation vulnerability that exists in Microsoft Windows. Microsoft Windows could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a pool-based buffer overflow in the Kernel Cryptography Driver (cng.sys). By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

This vulnerability affects the following Microsoft products:

• Windows 10 Version 1903 for ARM64-based Systems
• Windows Server 2016
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 2004 for x64-based Systems
• Windows Server version 1909 (Server Core installation)
• Windows Server version 2004 (Server Core installation)
• Windows 8.1 for 32-bit systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 10 Version 1803 for ARM64-based Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1903 for 32-bit Systems
• Windows 8.1 for x64-based systems
• Windows Server 2012
• Windows Server 2016 (Server Core installation)
• Windows 10 Version 20H2 for x64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows Server version 1903 (Server Core installation)
• Windows Server version 20H2 (Server Core Installation)
• Windows 10 Version 2004 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2019
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1803 for x64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1803 for 32-bit Systems
• Windows RT 8.1
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

CVE-2020-16970

CVE-2020-16970 is an arbitrary code execution vulnerability that exists in Microsoft Azure Sphere. Microsoft Azure Sphere could allow a local attacker to execute arbitrary code on the system.

CVE-2020-17084

CVE-2020-17084 is a remote code execution vulnerability that exists in Microsoft Exchange Server. Microsoft Exchange Server could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

This vulnerability affects the following Microsoft products:

• Microsoft Exchange Server 2019 Cumulative Update 7
• Microsoft Exchange Server 2016 Cumulative Update 17
• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2016 Cumulative Update 18
• Microsoft Exchange Server 2019 Cumulative Update 6

CVE-2020-17016

CVE-2020-17016 is a spoofing vulnerability that exists in Microsoft SharePoint. Microsoft SharePoint could allow a remote authenticated attacker to conduct spoofing attacks. This attack-focused weakness could be caused by improperly implemented authentication schemes that are subject to spoofing attacks.

This vulnerability affects the following Microsoft products:

• Microsoft SharePoint Enterprise Server 2013 Service Pack 1
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2010 Service Pack 2
• Microsoft SharePoint Server 2019

CVE-2020-17061

CVE-2020-17061 is a remote code execution vulnerability that exists in Microsoft SharePoint. Microsoft SharePoint could allow a remote attacker to execute arbitrary code on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.

This vulnerability affects the following Microsoft products:

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Foundation 2013 Service Pack 1
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Foundation 2010 Service Pack 2

CVE-2020-17042

CVE-2020-17042 is a remote code execution vulnerability that exists in Microsoft Windows. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in Print Spooler. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

This vulnerability affects the following Microsoft products:

• Windows 10 Version 1903 for ARM64-based Systems
• Windows Server 2016
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 2004 for x64-based Systems
• Windows Server version 1909 (Server Core installation)
• Windows Server version 2004 (Server Core installation)
• Windows 8.1 for 32-bit systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 10 Version 1803 for ARM64-based Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1903 for 32-bit Systems
• Windows 8.1 for x64-based systems
• Windows Server 2012
• Windows Server 2016 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows Server version 1903 (Server Core installation)
• Windows Server version 20H2 (Server Core Installation)
• Windows 10 Version 2004 for ARM64-based Systems
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2019
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1803 for x64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1803 for 32-bit Systems
• Windows RT 8.1
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Other Microsoft Vulnerabilities

Other notable Microsoft vulnerabilities are tracked as CVE-2020-16988, an elevation of privilege vulnerability impacting Azure Sphere, CVE-2020-17058, a memory corruption vulnerability impacting Microsoft Browser, CVE-2020-17048, also a memory corruption vulnerability impacting Chakra Scripting Engine, CVE-2020-17105, a remote code execution vulnerability impacting AV1 Video Extension, CVE-2020-17053, another memory corruption vulnerability impacting Internet Explorer, CVE-2020-17052, also a memory corruption vulnerability impacting Scripting Engine.

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2020-11-06 - 2020-11-12

Reverse shell botnet Gitpaste-12 spreads via GitHub and Pastebin - BleepingComputer

A newly discovered worm and botnet named Gitpaste-12 has been lurking on GitHub and Pastebin. It was first detected by Juniper Threat Labs on October 15, 2020. However, commits reveal the malware has lived on GitHub since July 9th, 2020 until it was shut down after Oct 27, 2020. The advanced malware comes equipped with reverse shell and crypto-mining capabilities and exploits over 12 known vulnerabilities. The worm attempts to crack passwords via brute-force and exploits the known vulnerabilities on the infected systems. After the initial system compromise, the malware downloads a recursive script from a Pastebin URL which instructs the infected host to keep executing this very script every minute. The main shell script is then downloaded from GitHub, which starts disabling the defenses on the targeted system. The malware is also equipped with a Monero (XMR) cryptocurrency miner. It propagates via randomly generated list of IP addresses within a subnet range. The hide.so payload helps the malware in evading detection by antivirus engines.

See the full report here: https://www.bleepingcomputer.com/news/security/reverse-shell-botnet-gitpaste-12-spreads-via-github-and-pastebin/

WordPress Sites Open to Code Injection Attacks via Welcart e-Commerce Bug

A security vulnerability was discovered in the Welcart e-Commerce plugin that opens up websites to code injection. This can lead to payment skimmers being installed, crashing of the site, or information retrieval via SQL injection. Welcart e-Commerce is a free WordPress plugin that allows site owners to add online shopping to their sites in a turn-key fashion, with options to sell physical merch, digital goods and subscriptions, with 16 different payment options. The high-severity bug (CVE is pending) is a PHP object-injection vulnerability, which exists in the way the platform handles cookies. It uses its own cookies, separate from the ones used by WordPress, in order to track user sessions. The cookie parameter set can be used to pass a specially crafted string which, once unserialized, would inject a PHP object. The plugin’s publisher has patched the issue in version 1.9.36 of Welcart. Site admins are advised to upgrade immediately to prevent such attacks.

See the full report here: https://threatpost.com/wordpress_open_to_attacks_welcart_bug/161037/

Hackers target flaws in PBX system to hijack VoIP calls

Cybercriminals have launched a new campaign that targets Sangoma PBX, an open-source web GUI that manages communications toolkit Asterisk. The attack exploits CVE-2019-19006, a critical vulnerability in Sangoma private branch exchange (PBX), which grants the attacker admin access to the system and gives them control over its functions. The purpose of the campaign is to lift phone numbers and gain live access to compromised VoIP services. Researchers identified several online profiles associated with private Facebook groups that deal with VoIP, and more specifically, SIP server exploitation. The group has mostly tried to gain access to phone numbers, and sell these on to other groups, and grant access to compromised VoIP services to the highest bidders, who can then exploit those services for their purposes. Companies using vulnerable systems have been urged to change all default passwords, and analyze call billings regularly as well as applying patches to mitigate the CVE-2019-19006 vulnerability.

See the full report here: https://www.itpro.co.uk/security/357678/hackers-target-flaws-in-pbx-system-to-hijack-voip-calls

New Pay2Key ransomware encrypts networks within one hour - BleepingComputer

New ransomware called Pay2Key has been targeting organizations from Israel and Brazil, encrypting their networks within an hour. According to Check Point researchers, the threat actors behind Pay2Key ransomware are using publicly exposed Remote Desktop Protocol (RDP) to gain access to victims' networks and deploy the initial malicious payloads. Once inside a victim's network, the attackers will set up a pivot device that will be used as a proxy for all outgoing communications between the ransomware infected computers and Pay2Key's C2 servers. Pay2Key actors use Microsoft's legitimate PsExec portable tool to remotely execute ransomware payloads named Cobalt[.]Client[.]exe on the targeted organizations' network devices. Following successful encryption of a device, the ransomware will drop a ransom note on the system, customized for each compromised organization, and using a [ORGANIZATION]_MESSAGE.TXT name. While the attack is still under investigation, the recent Pay2Key ransomware attacks indicate a new threat actor is joining the trend of targeted ransomware attacks, presenting well-designed operation to maximize damage and minimize exposure.

See the full report here: https://www.bleepingcomputer.com/news/security/new-pay2key-ransomware-encrypts-networks-within-one-hour/

RansomExx ransomware also encrypts Linux systems - BleepingComputer

A report from Kaspersky has uncovered a Linux version of the RansomExx ransomware, also known as Defray777. The Linux version is named 'decryptor64' and is a command-line driven decryptor. When targeting Linux servers, the RansomExx operators will deploy an ELF executable named 'svc-new' used to encrypt a victim's server. The Linux executable is embedded with a public RSA-4096 encryption key, the ransom note, and an extension named after the customer that will be appended to all encrypted files. If a victim pays the ransom, they will receive both a Linux and Windows decryptor with the corresponding RSA-4096 private key and encrypted file extension embedded in the executable.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomexx-ransomware-also-encrypts-linux-systems/

Sodinokibi/REvil ransomware gang pwns British housing biz via suspected phishing attack

A Norwich based social housing provider Flagship Group has been hit in a ransomware attack. The company has confirmed that the incident was caused by a ransomware group, known as Sodinokibi, via a suspected phishing attack. The company is investigating the issue with the help of cyber experts to determine the scope of the incident. Currently, the company is unaware of the ransom demands as they have not engaged with the criminals. Cyber experts have advised Flagship Group to refrain from paying the Sodinokibi/REvil gang's ransom demands.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/11/06/revil_sodinokibi_ransomware_gang_flagship_group_housing/

FBI: Hackers stole source code from US government agencies and private companies

The US Federal Bureau of Investigation (FBI) has issued a security alert saying threat actors have stolen source code from government agencies and private firms and are abusing it to gain access to critical information. The FBI alert warned the owners of SonarQube, a web-based application that companies integrate into their software build chains to test source code and discover security flaws before rolling out code and applications into production environments. The actors exploit known configuration vulnerabilities, allowing them to gain access to proprietary code, exfiltrate it, and post the data publicly. The FBI has identified multiple potential computer intrusions that correlate to leaks associated with SonarQube configuration vulnerabilities. According to the FBI, some companies have left these systems unprotected, running on their default configuration with default admin credentials. The FBI suggested the firms to change the SonarQube default settings, including changing the default administrator username, password, and port (9000).

See the full report here: https://www.zdnet.com/article/fbi-hackers-stole-source-code-from-us-government-agencies-and-private-companies/

Luxottica data breach exposes LensCrafters, EyeMed patient info - BleepingComputer

Luxottica has disclosed that their appointment scheduling application suffered a data breach after being hacked on August 5th, 2020. The company first learned about this breach on August 9 and, after investigating the attack, determined on August 28 that the attacker gained access to patients' personal information for patients of LensCrafters, Target Optical, EyeMed, and other eye care practices. Luxottica preliminarily concluded that the attacker might have accessed and acquired patient information, including personal data (PII) and protected health information (PHI), including medical conditions and history. The personal information involved in this incident may have included full name, contact information, appointment date and time, health insurance policy number, and doctor or appointment notes. For some patients, credit card numbers and social security numbers were also exposed. Luxottica has notified the impacted customers is offering a free two-year identity monitoring service for patients who have had their payment information and SSNs exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/luxottica-data-breach-exposes-lenscrafters-eyemed-patient-info/

E-grocery BigBasket admits to customer data 'breach' - ETCIO.com

Indian online food and grocery store BigBasket has admitted to a potential breach after its database, containing information of nearly 20 million customers, was put up for sale in a cyber-crime market at $40,000. The leaked data might have exposed BigBasket's customer data, including email IDs, password hashes (potentially hashed OTPs), Pin, contact numbers, order details, and addresses. The company stated that they do not store customers' financial data, including credit card numbers, and are confident that financial data is secure. The e-commerce platform has filed a complaint with the Cyber ​​Crime Cell in Bangaluru and investigating the incident.

See the full report here: https://cio.economictimes.indiatimes.com/news/digital-security/e-grocery-bigbasket-admits-to-customer-data-breach/79121215

Trump lawsuit site to report rejected votes leaked voter data - BleepingComputer

President Trump's re-election campaign and the Republican National Committee filed a lawsuit in Arizona alleging the polling officials in Maricopa County had incorrectly rejected in-person votes on Election Day, by misusing a mechanical feature (a green button) of the voting machines. To collect anecdotal evidence from voters who may have observed such behavior at the polling stations which validates what the lawsuit alleges, the campaign set up a website to collect information from voters, such as their name and address, phone number, email address, date of birth, last 4 digits of social security number (SSN), and answers to multiple-choice questions. The website used an API that may make it possible for anyone to scrape voter information in bulk. Some users are calling it "hastily set-up" and ridden with data leaks and SQL Injection flaws. The API from the website has been removed following the complaints from the users.

See the full report here: https://www.bleepingcomputer.com/news/security/trump-lawsuit-site-to-report-rejected-votes-leaked-voter-data/

HMRC smishing tax scam targets UK banking customers - BleepingComputer

In a new smishing campaign, attackers are targeting UK residents with an advanced HM Revenue and Customs (HMRC) tax rebate scam, employing multiple HMRC phishing domains and tactics, with new domains added every day as older ones get flagged by spam filters. The hackers also have entire online banking workflows built into them, depending on who your banking provider is. The details collected by this campaign include but are not limited to full name, date of birth, home address, phone number, email address, and passwords, credit card information, bank account information: sort code and account number, online banking credentials, National Insurance Number (NINo), Passport number, Driving license number, memorable words and/or answers to security questions, 2-factor codes generated by online banking hardware devices (security tokens and card readers). People are encouraged to report to HMRC if they have received similar suspicious messages, phone calls, or emails that claim to come from HMRC.

See the full report here: https://www.bleepingcomputer.com/news/security/hmrc-smishing-tax-scam-targets-uk-banking-customers/

New 'Ghimob' malware can spy on 153 Android mobile applications

Security researchers have discovered a new Android banking trojan dubbed Ghimob that can spy and steal data from 153 Android applications. According to Kaspersky, the malware has been developed by the same group behind the Astaroth (Guildma) Windows malware. Most of the targeted apps were for Brazilian banks. However, recently updated versions also expanded its capabilities to target banks in Germany, Portugal, Peru, Paraguay, Angola, and Mozambique. To distribute the malware, the Ghimob group used emails or malicious sites to redirect users to websites promoting Android apps. These apps impersonated official apps and brands, with names such as Google Defender, Google Docs, WhatsApp Updater, or Flash Update. If users installed these fake apps, they would request access to the Accessibility service as a final step in the infection process. If granted, the apps would search the infected phone for a list of 153 apps for which it would show fake login pages in an attempt to steal the user's credentials. The updated version of Ghimob also targeted cryptocurrency exchange apps in attempts to gain access to cryptocurrency accounts. After successful phishing, the collected credentials were sent back to the Ghimob gang, which would then access a victim's account and initiate illegal transactions.

See the full report here: https://www.zdnet.com/article/new-ghimob-malware-can-spy-on-153-android-mobile-applications/

Npm package caught stealing sensitive Discord and browser files

Sonatype security researchers have discovered an npm package, discored.dll, that contains malicious code designed to steal sensitive files from a user's browsers and Discord application. discord.dll is a malicious JavaScript library that is still available via npm, a web portal, command-line utility, and package manager for JavaScript programmers. Sonatype explains that once installed, discord.dll runs malicious code to search a developer's computer for certain applications and then retrieve their internal LevelDB databases. Targeted apps include browsers like Google Chrome, Brave, Opera, Yandex Browser, and the Discord instant messaging app. The files the malware retrieves are LevelDB databases, which the targeted apps use to store information such as browsing histories and various access tokens. Discord.dll would read the files and attempt to post their content in a Discord channel. Users can expect the malicious package to be removed from npm soon.

See the full report here: https://www.zdnet.com/article/npm-package-caught-stealing-sensitive-discord-and-browser-files/

Fake Microsoft Teams updates lead to Cobalt Strike deployment - BleepingComputer

In an attempt to infect target systems with backdoors that deploy Cobalt Strike, ransomware attackers are using malicious fake ads for Microsoft Teams updates to trick victims. These attacks target organizations in various industries, however recent ones focused on the education sector (K-12), which depends on videoconferencing solutions due to Covid-19 restrictions. In at least one attack Microsoft detected, the attackers purchased a search engine ad that caused top results for Teams software to point to a domain under their control. Clicking on the link downloaded a payload that executed a PowerShell script to retrieve more malicious content. It also installed a legitimate copy of Microsoft Teams on the system to keep victims unaware of the attack. Microsoft says that in many cases, the initial payload was Predator the Thief infostealer, which sends the attacker sensitive information like credentials, browser, and payment data. The malware also downloaded other payloads with Cobalt Strike beacons being among them, hence allowing the attackers to move laterally across the network. Microsoft is warning that the same patterns seen in the FakeUpdates campaigns using Teams updates as lure were observed in at least six others, suggesting the same actor behind them. Among the many recommendations mentioned by Microsoft in a non-public security advisory seen by BleepingComputer, the company suggests using web browsers that can filter and block malicious websites (scam, phishing, malware and exploit hosts) along with using strong, random passwords for local administrators.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/

New Slipstream NAT bypass attacks to be blocked by browsers - BleepingComputer

Web browser vendors are planning to block a new attack technique dubbed NAT Slipstreaming that would allow attackers to bypass a victim's NAT, firewall, or router to gain access to any TCP/UDP service hosted on their devices. NAT Slipstreaming requires the victims to visit the threat actor's malicious website (or a site with maliciously crafted ads). To expose hosted services, the attack abuses certain NAT devices scanning port 5060 to create port forwarding rules when detecting maliciously-crafted HTTP requests camouflaged as valid SIP requests. Samy Kamkar who discovered the attack technique and created a PoC for the same, explains that the attack requires the NAT/firewall to support ALG (Application Level Gateways), which are mandatory for protocols that can use multiple ports (control channel + data channel) such as SIP and H323 (VoIP protocols), FTP, IRC DCC, etc. Web browser vendors are planning to block the 5060 and 5061 TCP ports used in NAT Slipstreaming attack by adding them to the restricted list.

See the full report here: https://www.bleepingcomputer.com/news/security/new-slipstream-nat-bypass-attacks-to-be-blocked-by-browsers/

Millions of Hotel Guests Worldwide Caught Up in Mass Data Leak

A misconfigured Amazon Web Services S3 bucket belonging to Prestige Software’s “Cloud Hospitality,” used by hotels to integrate their reservation systems with online booking websites like Expedia and Booking.com, has exposed nearly 10 million files related to guests at various hotels around the world. The exposed S3 bucket was secured the following day of its discovery. However, the incident has affected 24.4 GB worth of data in total, according to the security team at Website Planet, which uncovered the bucket. The exposed records contain a raft of information, Website Planet said, including full names, email addresses, national ID numbers and phone numbers of hotel guests, card numbers, cardholder names, CVVs and expiration dates, and reservation details, such as the total cost of hotel reservations, reservation number, dates of a stay, special requests made by guests, number of people, guest names and much more. No evidence of misuse of the exposed data has been found so far, but the impacted guests could be the targets of a wide range of attacks, from identity theft to phishing.

See the full report here: https://threatpost.com/millions-hotel-guests-worldwide-data-leak/161044/

WordPress plugin bugs can let attackers hijack up to 100K sites - BleepingComputer

A WordPress plugin called Ultimate Member has three critical security bugs that could each allow privilege escalation and potentially full control over a target WordPress site. The plugin allows web admins to add user-profiles and membership areas to their web destinations. According to Wordfence researchers, the flaws make it possible for both authenticated and unauthenticated attackers to escalate their privileges during registration to attain the status of an administrator. Admins of WordPress sites who use the Ultimate Member plugin urged to update it to the latest version to block attacks attempting to exploit multiple critical and easy to exploit vulnerabilities that could lead to site takeovers.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-plugin-bugs-can-let-attackers-hijack-up-to-100k-sites/

Bug hunter wins 'Researcher of the Month' award for DOD account takeover bug

The US Department of Defense has fixed a severe vulnerability impacting its internal network. The vulnerability was discovered by a security researcher at US security firm Silent Breach and privately reported and patched via the DOD's Vulnerability Disclosure Program (VDP). According to the summary report, the bug was categorized as an Insecure Direct Object References (IDOR) vulnerability, a bug where security checks are missing from an application, allowing hackers to modify a few parameters without any additional identity checks. The severity of the reported issue earned the researcher DOD's "Researcher of the Month" award, despite the bug being the researcher's first DOD VDP report. The DOD fixed the bug by adding a user session mechanism to the DOD account system, preventing attackers from modifying parameters without authenticating on the site.

See the full report here: https://www.zdnet.com/article/bug-hunter-wins-researcher-of-the-month-award-for-dod-account-takeover-bug/

Windows 10 Intel microcode released to fix new CPU security bugs - BleepingComputer

Security researchers have disclosed new Intel CPU side-channel vulnerabilities called Platypus. These vulnerabilities reside in Intel's Running Average Power Limit (RAPL) interface, allowing users to monitor and manage the power consumption of supported CPUs and DRAM memory. The researchers showed that they could use the RAPL interface to monitor power consumption and deduce what instructions were being performed by a CPU, allowing them to steal sensitive data from memory. Microsoft released new Intel Microcode updates to fix the latest vulnerabilities in Intel CPUs tracked as CVE-2020-8695, CVE-2020-8696, and CVE-2020-8698, including Platypus. Users are recommended to install new Microcode updates.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-intel-microcode-released-to-fix-new-cpu-security-bugs/

Claroty Details Vulnerabilities in Schneider PLCs

Researchers at Claroty have released new details on authentication and encryption vulnerabilities found in Schneider Electric programmable logic controllers (PLCs). The vulnerabilities are tracked as CVE-2020-7565, CVE-2020-7566, CVE-2020-7567, CVE-2020-7568. That if exploited, could allow an attacker to exfiltrate data, modify code, and execute commands on operational technology (OT) and critical infrastructure systems. An attacker would have to establish a presence on the OT network and monitor data flowing between devices before exploiting weak encryption implementations to crack device authentication. Mitigations for the four vulnerabilities are available from Schneider.

See the full report here: https://www.darkreading.com/threat-intelligence/claroty-details-vulnerabilities-in-schneider-plcs/d/d-id/1339417

Ransomware hits e-commerce platform X-Cart

E-commerce software vendor X-Cart suffered a ransomware attack at the end of October that brought down customer stores hosted on the company's hosting platform. The incident is believed to have taken place after attackers exploited a vulnerability in third-party software to gain access to X-Cart's store hosting systems. The attackers gained access to a small number of servers, which they encrypted, effectively bringing down X-Cart stores running on top of the impacted systems. Some stores went down completely, while others reported issues with sending email alerts. The firm stated that core systems were not impacted and all customer websites have since been restored.

See the full report here: https://www.zdnet.com/article/ransomware-hits-e-commerce-platform-x-cart/

Ransomware Group Turns to Facebook Ads

The Ragnar Locker ransomware gang has started using hacked Facebook Inc. accounts to run ads to pressure Italian drinks maker Davide Campari-Milano S.p.A., also known by the name Campari, publicly into paying its demanded ransom. The Facebook account used for the ad belonged to Hodson Event Entertainment. The company’s founder said the account got hacked and that the ransomware gang had budgeted $500 for the campaign. Notably, the company founder said that he thought he had two-factor authentication turned on for all of his accounts, but not for his Facebook account. Campari had said in a statement that at this stage, they could not exclude that some personal and business data taken by the ransomware gang, a claim directly addressed in the Facebook ads.

See the full report here: https://krebsonsecurity.com/?p=53550

Ubuntu's Gnome desktop could be tricked into giving root access - BleepingComputer

A security researcher discovered two vulnerabilities in GNOME Display Manager (gdm3) AccountsService that caused the component to hang (CVE-2020-16127) and drop user account privileges (CVE-2020-16126), allowing a standard user to crash the daemon by sending it a delayed segmentation fault signal. An attacker could trigger these vulnerabilities by modifying the system Settings that did not require elevated privileges. Without the AccountsService running, gdm3 has no clue about the accounts present on the machine and provides the option to create a new one with root privileges, as in the case of a first-time setup. These two vulnerabilities affect Ubuntu 20.10, Ubuntu 20.04, Ubuntu 18.04, and Ubuntu 16.04. The researcher reported them to Ubuntu and GNOME maintainers on October 17, and fixes are available in the latest code.

See the full report here: https://www.bleepingcomputer.com/news/security/ubuntus-gnome-desktop-could-be-tricked-into-giving-root-access/

xHunt hackers hit Microsoft Exchange with two news backdoors

Security researchers from Palo Alto Networks discovered two new Powershell backdoors attacks on Microsoft Exchange servers at an organization in Kuwait. The attackers used two new backdoors tracked as TriFive and a variant of a previously discovered PowerShell-based backdoor dubbed as CASHY200, called Snugy. Both provide backdoor access to the compromised Exchange server, using different command and control (C2) channels to communicate with the actors. The TriFive backdoor uses an email-based channel that uses Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account and, the Snugy backdoor uses a DNS tunneling channel to run commands on the compromised server.

See the full report here: https://securityaffairs.co/wordpress/110644/apt/xhunt-attackers-hit-microsoft-exchange.html?utm_source=rss&utm_medium=rss&utm_campaign=xhunt-attackers-hit-microsoft-exchange

5.8 million RedDoorz user records for sale on hacking forum - BleepingComputer

At the end of September 2020, RedDoorz, a Singapore-based hotel management & booking platform, disclosed that they suffered a data breach after an unauthorized person accessed one of their databases. This week a threat actor began selling a database containing 5.8 million user records that were stolen during RedDoorz's data breach on a hacker forum. As part of the sale, the threat actor shared a database sample, including the table structure and records for 587 users. For each user records in the database, a RedDoorz member's email, bcrypt hashed passwords, full name, gender, link to profile photo, phone number, secondary phone number, date of birth, and occupation is exposed. However, it does not contain any financial information. RedDoorz users are advised to change their password immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/58-million-reddoorz-user-records-for-sale-on-hacking-forum/

Intel fixes 95 vulnerabilities in November 2020 Platform Update

Intel addressed 95 vulnerabilities as part of the November 2020 Patch Tuesday, including critical ones affecting Intel Wireless Bluetooth products and Intel Active Management Technology (AMT). The first critical flaw tracked as CVE-2020-8752 with a CVSS score of 9.4/10 is an out-of-bounds write in the IPv6 subsystem of Intel AMT and ISM versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 14.0.45 that enables remote unauthenticated to escalate privileges. A second critical flaw tracked as CVE-2020-12321 with a CVSS score of 9.6/10, affecting some Intel Wireless Bluetooth products. The bug is an improper buffer restriction in Wireless Bluetooth products before version 21.110 that enables unauthenticated escalation of privilege via adjacent access. The new Intel CPU side-channel vulnerabilities (CVE-2020-8694 and CVE-2020-8695) dubbed PLATYPUS were also patched by Intel.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-fixes-95-vulnerabilities-in-november-2020-platform-update/

Alleged source code of Cobalt Strike toolkit shared online

The source code for the widely-used Cobalt Strike post-exploitation toolkit has allegedly been leaked online in a GitHub repository. Cobalt Strike is a legitimate penetration testing toolkit that allows attackers to deploy beacons on compromised devices to remotely create shells, execute PowerShell scripts, perform privilege escalation, or spawn a new session to create a listener on the victim system. Twelve days ago, a repository was created on GitHub that contains what appears to be the source code for Cobalt Strike 4.0 released on December 5th, 2019. The leak of the offensive tool opens the door for the additional crime actor enhancement of the tooling. Cobalt Strike and their parent company Help Systems is yet to confirm the authenticity of the source code.

See the full report here: https://www.bleepingcomputer.com/news/security/alleged-source-code-of-cobalt-strike-toolkit-shared-online/

Google patches two more Chrome zero-days

Google has released today Chrome version 86.0.4240.198 to patch two zero-day vulnerabilities that were exploited in the wild. The two zero-days are tracked as CVE-2020-16013 is an inappropriate implementation in V8, where V8 is the Chrome component that handles JavaScript code and CVE-2020-16017 is a use after free memory corruption bug in Site Isolation, the Chrome component that isolates each site's data from one another. It is currently unknown if the two vulnerabilities have been used together, as part of an exploit chain, or used individually. Chrome users are advised to update to v86.0.4240.198 via the browser's built-in update function as soon as possible.

See the full report here: https://www.zdnet.com/article/google-patches-two-more-chrome-zero-days/

Animal Jam kids' virtual world hit by data breach, impacts 46M accounts

The popular children's online playground Animal Jam has suffered a data breach impacting 46 million accounts. Animal Jam is a virtual world created by WildWorks, where kids can play online games with other members. A threat actor shared two databases belonging to Animal Jam for free on a hacker forum that they stated were obtained by ShinyHunters, a well-known website hacker. As part of the free release, the threat actor shared only a partial database containing approximately 7 million user records. WildWorks believes that the threat actors obtained WildWork's AWS key after compromising the company's Slack server. The threat actors gained access to databases that contained 46 million player usernames, and SHA1 hashed passwords, 7 million email addresses that are associated with accounts, and IP addresses used by the parent or player when they signed up for an account. 116 of these records (all from 2010) also include the parent’s name and billing address but no credit card info. The users of Animal Jam are advised to change the account's password.

See the full report here: https://www.bleepingcomputer.com/news/security/animal-jam-kids-virtual-world-hit-by-data-breach-impacts-46m-accounts/